Microsoft · Security update · November 8, 2022

KB5019959: November 2022 cumulative update for Windows 10 20H2

KB5019959, released November 8, 2022, fixes 39 CVEs across 11 products. 6 of them are being exploited (CVE-2021-34527); 6 on CISA KEV. Patch Radar priority: Patch now.

Patch now6 on CISA KEVKnown ransomware use2 publicly disclosed
CVEs closed
39
7 rated Critical
Exploited
6
CVE-2021-34527
Exploitation more likely
9
Vendor assessment
Highest EPSS
0.9979
99th percentile

Priority of the 39 CVEs

Patch now 6 Urgent 13 High 15 Routine 5

Applies to

Product
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2021-34527 Windows Print Spooler Components Remote Code Execution 8.8 0.9979 KEVRansomwareDisclosedExploited
Patch now CVE-2022-41128 Windows Scripting Remote Code Execution 8.8 0.2462 KEVExploited
Patch now CVE-2022-41049 Windows Mark of the Web (MOTW) Security Feature Bypass 5.4 0.0327 KEVExploited
Patch now CVE-2022-41125 Windows CNG Key Isolation Service Elevation of Privilege 7.8 0.0305 KEVExploited
Patch now CVE-2022-41073 Windows Print Spooler Components Elevation of Privilege 7.8 0.0263 KEVRansomwareExploited
Patch now CVE-2022-41091 Windows Mark of the Web (MOTW) Security Feature Bypass 5.4 0.0225 KEVRansomwareDisclosedExploited
Urgent CVE-2022-41113 Microsoft Graphics Component Elevation of Privilege 7.8 0.0813 More likely
Urgent CVE-2022-41109 Windows Win32K Elevation of Privilege 7.8 0.0812 More likely
Urgent CVE-2022-41058 Windows Network Address Translation (NAT) Denial of Service 7.5 0.0254 More likely
Urgent CVE-2022-41039 Windows Point-to-Point Tunneling Protocol Remote Code Execution 8.1 0.0139 Exploitation Less Likely
Urgent CVE-2022-41118 Windows Scripting Remote Code Execution 7.5 0.0137 More likely
Urgent CVE-2022-41090 Windows Point-to-Point Tunneling Protocol Denial of Service 5.9 0.0129 More likely
Urgent CVE-2022-41088 Windows Point-to-Point Tunneling Protocol Remote Code Execution 8.1 0.0126 Exploitation Less Likely
Urgent CVE-2022-41057 Windows HTTP.sys Elevation of Privilege 7.8 0.0126 More likely
Urgent CVE-2023-21712 Windows Point-to-Point Tunneling Protocol Remote Code Execution 8.1 0.0099 Exploitation Unlikely
Urgent CVE-2022-41092 Windows Win32K Elevation of Privilege 7.8 0.0081 More likely
Urgent CVE-2022-41096 Windows DWM Core Library Elevation of Privilege 7.8 0.0072 More likely
Urgent CVE-2022-38015 Role: Windows Hyper-V Denial of Service 6.5 0.0070 Exploitation Less Likely
Urgent CVE-2022-41055 Windows Devices Human Interface Information Disclosure 5.5 0.0064 More likely
High CVE-2022-41056 Network Policy Server (NPS) Denial of Service 7.5 0.0254 Exploitation Less Likely
High CVE-2022-41053 Windows Kerberos Denial of Service 7.5 0.0252 Exploitation Less Likely
High CVE-2022-41047 Windows ODBC Driver Remote Code Execution 8.8 0.0195 Exploitation Less Likely
High CVE-2022-41048 Windows ODBC Driver Remote Code Execution 8.8 0.0195 Exploitation Less Likely
High CVE-2022-41052 Microsoft Graphics Component Remote Code Execution 7.8 0.0094 Exploitation Less Likely
High CVE-2022-41114 Windows Bind Filter Driver Elevation of Privilege 7.0 0.0063 Exploitation Less Likely
Showing 1 to 25 of 39 1Next